Tag
A developer building an AI personal assistant asks how others handle PII that must be shared with LLMs to be useful (location, school info) without leaking sensitive personal data, weighing privacy governance against convenience.
The study explores whether stereotype-loaded queries about culturally marked individuals lead to more personal information leakage from RAG systems than neutral queries, finding no evidence of such amplification after statistical corrections.
Patronus Ark is a new Rust and Python library for locally scanning AI agent text and tool activity, covering prompt injection, PII, data leakage, and tool-related risks without sending data to external APIs.
This paper audits privacy risk in English-source multilingual RAG across five query languages, testing whether non-English queries increase PII leakage. Using a Qwen2.5-7B pipeline with two-stage defenses, it finds English has the highest point-estimate leak rate under output-only filtering, with residual leaks on Arabic and Swahili when the input judge is added.
An analysis of 10,000 production AI support prompts found 12.4% contained personally identifiable information, arguing that LLM security should focus on data minimization and redaction rather than only prompt injection or jailbreaks.
A team used a fleet of autonomous AI agents with adversarial validation to clean and migrate 400 legacy database tables in two days, reducing human review to under 4% and avoiding the typical month-long manual ETL process.
Introduces Google Cloud's Model Armor tool, used in multi-agent systems to detect and redact sensitive data, prevent indirect prompt injection, support partial redaction and reversible hashing, and centrally manage security policies.
A security report reveals that over 10% of MCP servers leak credentials or personally identifiable information through tool responses, bypassing traditional SAST/DAST scanning.
Discusses the risks and considerations of sending Personally Identifiable Information (PII) to large language models.
Introduces a pure Go LLM privacy gateway that uses two-layer detection (regex and gitleaks rules) to redact PII and secrets in milliseconds without additional models/GPU, already in production.
A researcher discovered that deleteduser.com was being used as a placeholder domain by multiple companies to overwrite user email addresses during data deletion compliance, and after acquiring the domain, received PII from 30+ organizations including gyms, hotels, energy companies, and cybersecurity firms.